AI Security
AI Agent Tool Confused Deputy Problem in 2026
A senior engineer's take on the confused deputy problem in AI agent tool use, why it keeps reappearing in 2026, and the architectural patterns that actually fix it.
Mar 14, 20267 min read
Resources
Supply Chain Security, in plain English.
Deep dives, practical guides, and incident analyses from engineers who build Safeguard. No fluff, no vendor FUD — just what you need to ship secure software.
Filter
Articles
RSS feedRegulatory Compliance
FedRAMP High Supply Chain Controls in 2026
Rev 5 controls are the operative baseline, and the SR control family is where most FedRAMP High authorizations are now spending their assessor time in 2026.
Mar 14, 20265 min read
Vulnerability Research
Font File Vulnerability History: When Typography Becomes an Exploit
Font parsing has been a goldmine for attackers. The history of font vulnerabilities reveals deep supply chain risks in every operating system.
Mar 14, 20265 min read
Industry News
NIST NVD Recovery: The New Consortium Reshaping Vulnerability Data
After months of processing backlogs and community frustration, NIST announces a new consortium to modernize and sustain the National Vulnerability Database.
Mar 14, 20266 min read
Compliance
SOC 2 Type 1 vs Type 2: differences, timelines, and which...
Type 1 audits control design at a point in time; Type 2 tests operating effectiveness over months. How they differ, realistic timelines, and which to pursue first.
Mar 14, 20268 min read
Product
Reachability Analysis: Cutting Through Vulnerability Noise
Not every vulnerability in your dependencies is exploitable. Safeguard's reachability analysis determines whether vulnerable code paths are actually invoked in your application.
Mar 14, 20266 min read
Best Practices
Scoping a Vulnerability Bounty Program for Supply Chain
How to scope a bug bounty program that addresses supply chain risks: in-scope assets, payout tiers, triage workflow, and avoiding the trap of dependency CVE bounties.
Mar 14, 20266 min read
Compliance
SOC 1 vs SOC 2 vs SOC 3: how the three report types differ
SOC 1, SOC 2, and SOC 3 test different things for different audiences. Here's how they differ, and where Safeguard's supply chain evidence complements GRC tools like Secureframe.
Mar 14, 20268 min read
Open Source Security
Rust Procedural Macros: Security Risks
Proc macros are Rust code that runs at compile time with the privileges of the developer. They are one of the most underexamined pieces of the Rust supply chain.
Mar 14, 20266 min read
Stay informed
Weekly insights on software supply chain security, delivered to your inbox.
Self-healing security runs on Safeguard.
Your first fix PR is minutes away.
No sales call required, even your agent can complete the purchase over MCP.